Emerging Practices for Capital Adequacy © Copyright 2003, CCRO. All rights reserved. 40 6.4 Mitigation Techniques Often enacting mitigation is cheaper than reserving capital. Mitigation may come in many different forms, but in all cases techniques are used to reduce the company’s operative risk profile in a preventive rather than reserve manner. Discussions of mitigation techniques should include, but should not be limited to, the following three: • Insurance - Can be mapped to a taxonomy and database much like an actuarial table and makes intuitive sense. This technique may not cover all sources of loss resulting from an event. It may also be expensive relative to capital requirement. In addition, it may be one of the simplest controls to put into place initially. • Internal Controls - This is very important in techniques such as a scorecard approach where a risk profile is assumed and mitigants are needed to lower the profile. This is essential to company performance and gaining more momentum (e.g., Sarbanes-Oxley). It can leverage internal audit, but is not an internal audit responsibility. • Operational Mitigation - Places limits and controls on the operation and hedging of assets to minimize the effects from operational failure. These can become very complex and are often proprietary. These are essential tools for operative risk management when assets are involved. 6.5 Banking Operative Risk Measurement Techniques As stated in Section 6.1, the energy industry is inherently different from banking. This section further illustrates the difference between energy companies and banks in measuring operative risk. The following discussion of measurement techniques is meant to illustrate that the standard and basic indicator approaches are inadequate for estimating operative risk in the energy industry. While the two approaches may apply to banks, one must be cautious of misapplication when measuring operative risk in the energy sector. • Standardized Approach The standardized approach requires financial institutions to hold capital for operational risk equal to the sum of a fixed percentage of the gross income of each business unit. n i=1 i Incomei Gross K  =  where: = K Capital charge under the standardized approach = Incomei Gross Gross income for the i-th business line = i  A fixed percentage While gross income is often the risk indicator of choice, other financial data can be used: asset value, number of employees, book value of physical assets, number of transactions, and number of accounts, to name a few. A multiple of a single financial indicator is very poor given the diversity of business lines represented within the CCRO and the reliance on earnings from physical assets whose risks